<aside> 🧠 A good auditor never makes mistrakes v3.final

</aside>

1 Report Summary

1.1 Introduction

Botto is a decentralized, autonomous artist governed by $BOTTO holders.

ElevenYellow approached GoldmanDAO to perform a review of their new Botto NFT smart contracts. From March 30th to April 13th, 2022, the GoldmanDAO team conducted the review of the source code provided.

Our goal with this review is to assess any vulnerabilities that may be found in the current codebase and help the team to verify their implementation works as intended. Details on the scope and findings are collected in this document.

1.2 Scope

The code to review was frozen on March 8th, 2022 at commit https://github.com/GoldmanDAO/botto-nft-contracts/commit/0881729057a39b055a4c3c45efdc1ae96c8fdc1a in https://github.com/GoldmanDAO/botto-nft-contracts. This new repository was not reviewed before. To this point in time the repository contains a total of 7 contracts.

├── ethereum
│   ├── BottoActiveReward.sol
│   ├── BottoRetroactiveReward.sol
│   ├── IBottoGovernance.sol
│   ├── Migrations.sol
│   └── MockBottoGovernance.sol
└── polygon
    ├── BottoERC1155.sol
    └── Migrations.sol

The main contracts and the ones that will be auditet are:

All 3 contracts inherit from Openzeppelin’s upgradable contracts. Last official audit was perform for the v2.0 of the framework in 2018 and can be found here https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/audit/2018-10.pdf.

The additional 4 contracts in the repository are support contracts from integrations and project setup, including:

1.3 Findings

Our initial review resulted in 5 mayor findings including by severity: